# Monitoring FSx for Windows File Server file systems
Monitoring is an important part of maintaining the reliability, availability, and performance of FSx for Windows File Server and your AWS solutions. You should collect monitoring data from all parts of your AWS solution so that you can more easily debug a failure if one occurs. However, before you start monitoring FSx for Windows File Server, you should create a monitoring plan that includes answers to the following questions:
+ What are your monitoring goals?
+ What resources will you monitor?
+ How often will you monitor these resources?
+ What monitoring tools will you use?
+ Who will perform the monitoring tasks?
+ Who should be notified when something goes wrong?
For more information about logging and monitoring in FSx for Windows File Server, see the following topics.
**Topics**
+ [Automated and manual monitoring](#monitoring_automated_manual)
+ [Monitoring with Amazon CloudWatch](monitoring-cloudwatch.md)
+ [Logging Amazon FSx for Windows File Server API calls using AWS CloudTrail](logging-using-cloudtrail.md)
## Automated and manual monitoring
AWS provides various tools that you can use to monitor FSx for Windows File Server. You can configure some of these tools to do the monitoring for you, whereas some of the tools require manual intervention. We recommend that you automate monitoring tasks as much as possible.
### Automated monitoring tools
You can use the following automated monitoring tools to watch FSx for Windows File Server and report when something is wrong:
+ **Amazon CloudWatch Alarms** – Watch a single metric over a time period that you specify, and perform one or more actions based on the value of the metric relative to a given threshold over a number of time periods. The action is a notification sent to an Amazon Simple Notification Service (Amazon SNS) topic or Amazon EC2 Auto Scaling policy. CloudWatch alarms do not invoke actions simply because they are in a particular state; the state must have changed and been maintained for a specified number of periods. For more information, see [Monitoring with Amazon CloudWatch](monitoring-cloudwatch.md).
+ **Amazon CloudWatch Logs** – Monitor, store, and access your log files from AWS CloudTrail or other sources. For more information, see [What Is Amazon CloudWatch Logs?](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html) in the *Amazon CloudWatch Logs User Guide*.
+ **AWS CloudTrail Log Monitoring** – Share log files between accounts, monitor CloudTrail log files in real time by sending them to CloudWatch Logs, write log processing applications in Java, and validate that your log files have not changed after delivery by CloudTrail. For more information, see [Working with CloudTrail Log Files](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-working-with-log-files.html) in the *AWS CloudTrail User Guide*.
### Manual monitoring tools
Another important part of monitoring FSx for Windows File Server involves manually monitoring those items that the Amazon CloudWatch alarms don't cover. The FSx for Windows File Server, CloudWatch, and other AWS console dashboards provide an at-a-glance view of the state of your AWS environment.
Amazon FSx **Monitoring & performance** dashboard shows:
+ Current warnings and CloudWatch alarms
+ A summary of file system activity
+ File system storage capacity and utilization
+ File server and storage volume performance
+ CloudWatch alarms
Amazon CloudWatch Dashboard shows:
+ Current alarms and status
+ Graphs of alarms and resources
+ Service health status
In addition, you can use CloudWatch to do the following:
+ Create [customized dashboards](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Dashboards.html) to monitor the services you use.
+ Graph metric data to troubleshoot issues and discover trends.
+ Search and browse all your AWS resource metrics.
+ Create and edit alarms to be notified of problems.
For more information about the Amazon FSx **Monitoring & performance** dashboard, see [Using file system metrics](monitoring-cloudwatch.md#how_to_use_metrics).
# Monitoring with Amazon CloudWatch
Amazon CloudWatch collects and processes raw data from your FSx for Windows File Server file system into readable, near real-time metrics. These statistics are retained for a period of 15 months, giving you to access historical information to help gain perspectives on how your workflow or file system is performing.
FSx for Windows File Server publishes CloudWatch metrics in the following domains:
+ Network I/O metrics measure activity between clients accessing the file system and the file server.
+ File server metrics measure network throughput utilization, file server CPU and memory, and file server disk throughput and IOPS utilization.
+ Disk I/O metrics measure activity between the file server and the storage volumes.
+ Storage volume metrics measure disk throughput utilization for HDD storage volumes, and IOPS utilization for SSD storage volumes.
+ Storage capacity metrics measure storage usage, including storage savings due to Data Deduplication.
The following diagram illustrates an FSx for Windows File Server file system, its components, and the metric domains.
![\[FSx for Windows File Server reports metrics in CloudWatch that monitor network I/O, file server performance, and storage volume performance.\]](http://docs.aws.amazon.com/fsx/latest/WindowsGuide/images/metrics-overview-FSxW.png)
By default, Amazon FSx for Windows File Server sends metric data to CloudWatch at 1-minute periods, with the following exceptions that are emitted in 5-minute intervals:
+ `FileServerDiskThroughputBalance`
+ `FileServerDiskIopsBalance`
For more information about CloudWatch, see [What is Amazon CloudWatch?](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/WhatIsCloudWatch.html) in the *Amazon CloudWatch User Guide*.
Metrics might not be published for Single-AZ file systems during file system maintenance or infrastructure component replacement, and for Multi-AZ file systems during failover and failback between the primary and secondary file servers.
Some Amazon FSx CloudWatch metrics are reported as raw *Bytes*. Bytes are not rounded to either a decimal or binary multiple of the unit.
**Topics**
+ [CloudWatch metrics and dimensions](#fsx-windows-metrics)
+ [Using file system metrics](#how_to_use_metrics)
+ [Performance warnings and recommendations](#performance-insights-FSxW)
+ [Accessing file system metrics](accessingmetrics.md)
+ [Creating CloudWatch alarms](creating_alarms.md)
## CloudWatch metrics and dimensions
FSx for Windows File Server publishes the following metrics into the `AWS/FSx` namespace in Amazon CloudWatch for all file systems:
+ `DataReadBytes`
+ `DataWriteBytes`
+ `DataReadOperations`
+ `DataWriteOperations`
+ `MetadataOperations`
+ `FreeStorageCapacity`
FSx for Windows File Server publishes the metrics described in the following sections into the `AWS/FSx` namespace in Amazon CloudWatch for file systems configured with a throughput capacity of at least 32 MBps.
### Network I/O metrics
The `AWS/FSx` namespace includes the following network I/O metrics.
| Metric | Description |
| --- | --- |
| DataReadBytes | The number of bytes for read operations for clients accessing the file system. Units: Bytes Valid statistics: `Sum` |
| DataWriteBytes | The number of bytes for write operations for clients accessing the file system. Units: Bytes Valid statistics: `Sum` |
| DataReadOperations | The number of read operations for clients accessing the file system. Units: Count Valid statistics: `Sum` |
| DataWriteOperations | The number of write operations for clients accessing the file system. Units: Count Valid statistics: `Sum` |
| MetadataOperations | The number of metadata operations for clients accessing the file system. Units: Count Valid statistics: `Sum` |
| ClientConnections | The number of active connections between clients and the file server. Units: Count |
### File server metrics
The `AWS/FSx` namespace includes the following file server metrics.
| Metric | Description |
| --- | --- |
| NetworkThroughputUtilization | The network throughput on the file system as a percentage of the provisioned limit. This metric reflects all network activity on the file system, including client I/O, customer-scheduled tasks such as Data Deduplication, customer-enabled features such as Shadow Copies, and system background activities such as Multi-AZ replication and maintenance operations. Units: Percent |
| CPUUtilization | The percentage utilization of your file server’s CPU resources. Units: Percent |
| MemoryUtilization | The percentage utilization of your file server’s memory resources. Units: Percent |
| FileServerDiskThroughputUtilization | The disk throughput between your file server and its storage volumes, as a percentage of the provisioned limit determined by throughput capacity. Units: Percent |
| FileServerDiskThroughputBalance | The percentage of available burst credits for disk throughput between your file server and its storage volumes. Valid for file systems provisioned with throughput capacity of 256 MBps or less. Units: Percent |
| FileServerDiskIopsUtilization | The disk IOPS between your file server and storage volumes, as a percentage of the provisioned limit determined by throughput capacity. Units: Percent |
| FileServerDiskIopsBalance | The percentage of available burst credits for disk IOPS between your file server and its storage volumes. Valid for file systems provisioned with throughput capacity of 256 MBps or less. Units: Percent |
### Disk I/O metrics
The `AWS/FSx` namespace includes the following disk I/O metrics.
| Metric | Description |
| --- | --- |
| DiskReadBytes | The number of bytes for read operations that access storage volumes. Units: Bytes Valid statistics: Sum |
| DiskWriteBytes | The number of bytes for write operations that access storage volumes. Units: Bytes Valid statistics: Sum |
| DiskReadOperations | The number of read operations for the file server accessing storage volumes. Units: Count Valid statistics: `Sum` |
| DiskWriteOperations | The number of write operations for the file server accessing storage volumes. Units: Count Valid statistics: `Sum` |
### FSx for Windows storage volume metrics
The `AWS/FSx` namespace includes the following storage volume metrics.
| Metric | Description |
| --- | --- |
| DiskThroughputUtilization | (HDD only) The disk throughput between your file server and its storage volumes, as a percentage of the provisioned limit determined by the storage volumes. Units: Percent |
| DiskThroughputBalance | (HDD only) The percentage of available burst credits for disk throughput and disk IOPS for the storage volumes. Units: Percent |
| DiskIopsUtilization | (SSD only) The disk IOPS between your file server and storage volumes, as a percentage of the provisioned IOPS limit determined by the storage volumes. Units: Percent |
### Storage capacity metrics
The `AWS/FSx` namespace includes the following storage capacity metrics.
| Metric | Description |
| --- | --- |
| FreeStorageCapacity | The amount of available storage capacity. Units: Bytes Valid statistics: `Average`, `Minimum` |
| StorageCapacityUtilization | Used physical storage capacity as a percentage of total storage capacity. Units: Percent |
| DeduplicationSavedStorage | The amount of storage space saved by data deduplication, if it is enabled. Units: Bytes |
### Namespace and dimensions for FSx for Windows File Server metrics
FSx for Windows File Server metrics use the `FSx` namespace and provide metrics for a single dimension, `FileSystemId`. You can find a file system's ID using the [describe-file-systems](https://docs.aws.amazon.com/cli/latest/reference/fsx/describe-file-systems.html) AWS CLI command or the [DescribeFileSystems](https://docs.aws.amazon.com/fsx/latest/APIReference/API_DescribeFileSystems.html) API command. A file system ID takes the form of *fs-0123456789abcdef0*.
## Using file system metrics
There are two primary architectural components of each Amazon FSx file system:
+ The **file server** that serves data to clients accessing the file system.
+ The **storage volumes** that host the data in your file system.
FSx for Windows File Server reports metrics in CloudWatch that track the performance and resource utilization for your file system's file server and storage volumes. The following diagram illustrates an Amazon FSx file system with its architectural components, and the performance and resource CloudWatch metrics available for monitoring. The key property shown for a set of metrics is the file system property that determines the capacity for those metrics. Adjusting that property modifies the file system's performance for that set of metrics.
![\[FSx for Windows File Server reports metrics in CloudWatch that monitor network I/O, file server performance, and storage volume performance.\]](http://docs.aws.amazon.com/fsx/latest/WindowsGuide/images/file-server-metrics-FSxW.png)
Use the **Monitoring & performance** panel in the Amazon FSx console to view the FSx for Windows File Server CloudWatch metrics described in the following table.
[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/fsx/latest/WindowsGuide/monitoring-cloudwatch.html)
**Note**
1We recommend that you maintain an average throughput capacity utilization under 50% to ensure that you have enough spare throughput capacity for unexpected spikes in your workload, as well as for any background Windows storage operations (such as storage synchronization, deduplication, or shadow copies).
2HDD storage volumes can experience significant performance variations depending on the workload. Sudden spikes in IOPS or throughput can lead to disk performance degradation. For more information, see [HDD burst performance](performance.md#hdd-burst-performance).
## Performance warnings and recommendations
FSx for Windows provides you with performance warnings for file systems configured with a throughput capacity of at least 32 MBps. Amazon FSx displays a warning for a set of the CloudWatch metrics whenever one of these metrics has approached or crossed a predetermined threshold for multiple consecutive data points. These warnings provide you with actionable recommendations that you can use to optimize your file system's performance.
Warnings are accessible in several areas of the **Monitoring & performance** dashboard. All active or recent Amazon FSx performance warnings and any CloudWatch alarms configured for the file system that are in an ALARM state appear in the **Monitoring & performance** panel in the **Summary** section. The warning also appears in the section of the dashboard that the metric graph is displayed.
You can create CloudWatch alarms for any of the Amazon FSx metrics. For more information, see [Creating CloudWatch alarms](creating_alarms.md).
### Use performance warnings to improve file system performance
Amazon FSx provides actionable recommendations that you can use to optimize your file system's performance. These recommendations describe how you can address a potential performance bottle neck. You can take the recommended action if you expect the activity to continue, or if it's causing an impact to your file system's performance. Depending on which metric has triggered a warning, you can resolve it by increasing either the file system's throughput capacity or storage capacity, as described in the following table.
[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/fsx/latest/WindowsGuide/monitoring-cloudwatch.html)
**Note**
Certain file system events can consume disk I/O performance resources and potentially trigger performance warnings. For example:
The optimization phase of storage capacity scaling can generate increased disk throughput, as described in [Storage capacity increases and file system performance](managing-storage-configuration.md#storage-capacity-increase-and-performance)
For Multi-AZ file systems, events such as throughput capacity scaling, hardware replacement, or Availability Zone disruption result in automatic failover and failback events. Any data changes that occur during this time need to be synchronized between the primary and secondary file servers, and Windows Server runs a data synchronization job that can consume disk I/O resources. For more information, see [Managing throughput capacity](managing-throughput-capacity.md).
For more information file system performance, see [FSx for Windows File Server performancePerformance](performance.md).
# Accessing file system metrics
You can see Amazon FSx metrics for CloudWatch in the following ways.
+ The Amazon FSx console
+ The CloudWatch console
+ The CloudWatch CLI
+ The CloudWatch API
The following procedures describe how to access your file system's metrics using these various tools.
**To view file system metrics using the Amazon FSx console**
1. Open the Amazon FSx console at [https://console.aws.amazon.com/fsx/](https://console.aws.amazon.com/fsx/).
1. To display the **File system details** page, choose **File systems** in the navigation pane.
1. Choose the file system whose metrics you want to view.
1. To view graphs of the file system's metrics, choose **Monitoring & performance** on the second panel.
![\[Screen capture image of the Performance & monitoring panel in the Amazon FSx console.\]](http://docs.aws.amazon.com/fsx/latest/WindowsGuide/images/FSxW-monitor-perf-panel.png)
+ The **Summary** metrics are displayed by default, showing any active warnings and CloudWatch alarms along with **File system activity** metrics.
+ Choose **Storage** to view storage capacity and utilization metrics.
+ Choose **Performance** to view file server and storage performance metrics
+ Choose **CloudWatch alarms** to view graphs of any alarms configured for the file system.
For more information, see [Using file system metrics](monitoring-cloudwatch.md#how_to_use_metrics)
**To view metrics in the CloudWatch console**
1. To view a file system metric in the **Metrics** page of the Amazon CloudWatch console, navigate to the metric in the **Monitoring & performance** panel of the Amazon FSx console.
1. Choose **View in metrics** from the actions menu in the upper right of the metric graph, as shown in the following image.
![\[Image of the Total IOPS metric graphic, with the graph actions menu displayed to show the View in metrics action.\]](http://docs.aws.amazon.com/fsx/latest/WindowsGuide/images/view-metric-in-CW-fsxW.png)
This opens the **Metrics** page in the CloudWatch console, showing the metric graph, as shown in the following image.
![\[Image of the Total IOPS metric graphic shown in the CloudWatch console.\]](http://docs.aws.amazon.com/fsx/latest/WindowsGuide/images/metric-in-CW-console.png)
**To add metrics to a CloudWatch dashboard**
1. To add a set of FSx for Windows file system metrics to a dashboard in the CloudWatch console, choose the set of metrics (**Summary**, **Storage**, or **Performance**) in the **Monitoring & performance** panel of the Amazon FSx console.
1. Choose **Add to dashboard** in the upper right of the panel, this opens the CloudWatch console.
1. Select an existing CloudWatch dashboard from the list, or create a new dashboard. For more information, see [Using Amazon CloudWatch dashboards](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Dashboards.html) in the *Amazon CloudWatch User Guide*.
**To access metrics from the AWS CLI**
+ Use the [https://docs.aws.amazon.com/cli/latest/reference/cloudwatch/list-metrics.html](https://docs.aws.amazon.com/cli/latest/reference/cloudwatch/list-metrics.html) command with the `--namespace "AWS/FSx"` namespace. For more information, see the [AWS CLI Command Reference](https://docs.aws.amazon.com/cli/latest/reference/).
```
$ aws cloudwatch list-metrics --namespace "AWS/FSx"
aws cloudwatch list-metrics --namespace "AWS/FSx"
{
"Metrics": [
{
"Namespace": "AWS/FSx",
"MetricName": "DataWriteOperationTime",
"Dimensions": [
{
"Name": "FileSystemId",
"Value": "fs-09a106ebc3a0bb087"
}
]
},
{
"Namespace": "AWS/FSx",
"MetricName": "CapacityPoolWriteBytes",
"Dimensions": [
{
"Name": "VolumeId",
"Value": "fsvol-0cb2281509f5db3c2"
},
{
"Name": "FileSystemId",
"Value": "fs-09a106ebc3a0bb087"
}
]
},
{
"Namespace": "AWS/FSx",
"MetricName": "DiskReadBytes",
"Dimensions": [
{
"Name": "FileSystemId",
"Value": "fs-09a106ebc3a0bb087"
}
]
},
{
"Namespace": "AWS/FSx",
"MetricName": "CompressionRatio",
"Dimensions": [
{
"Name": "FileSystemId",
"Value": "fs-0f84c9a176a4d7c92"
}
]
},
.
.
.
}
```
**Using the CloudWatch API**
**To access metrics from the CloudWatch API**
+ Call `[GetMetricStatistics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricStatistics.html)`. For more information, see [Amazon CloudWatch API Reference](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/).
# Creating CloudWatch alarms
You can create a CloudWatch alarm that sends an Amazon SNS message when the alarm changes state. An alarm watches a single metric over a time period you specify, and performs one or more actions based on the value of the metric relative to a given threshold over a number of time periods. The action is a notification sent to an Amazon SNS topic or Auto Scaling policy.
Alarms invoke actions for sustained state changes only. CloudWatch alarms don't invoke actions simply because they are in a particular state; the state must have changed and been maintained for a specified number of periods. You can create an alarm from the Amazon FSx console or the CloudWatch console.
The following procedures describe how to create alarms for Amazon FSx using the console, AWS CLI, and API.
**To set a CloudWatch alarm (console)**
1. Open the Amazon FSx console at [https://console.aws.amazon.com/fsx/](https://console.aws.amazon.com/fsx/).
1. From the navigation pane, choose **File systems**, and then choose the file system you want to create the alarm for.
1. Choose the **Actions** menu, and choose **View details**.
1. On the **Summary** page, choose **Monitoring and performance**.
1. Choose **CloudWatch alarms**.
1. Choose **Create CloudWatch alarm**. You are redirected to the CloudWatch console.
1. Choose **Select metrics**, and choose **Next**.
1. In the **Metrics** section, choose **FSX**.
1. Choose **File System Metrics**, choose the metric you want to set the alarm for, and then choose **Select metric**.
1. In the **Conditions** section, choose the conditions you want for the alarm, and choose **Next**.
**Note**
Metrics may not be published during file system maintenance for Single-AZ file systems, or during failover and failback to or from the primary or secondary servers for Multi-AZ file systems. To prevent unnecessary and misleading alarm condition changes and to configure your alarms so that they are resilient to missing data points, see [ Configuring how CloudWatch alarms treat missing data](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data) in the *Amazon CloudWatch User Guide*.
1. If you want CloudWatch to send you an email or SNS notification when the alarm state triggers the action, choose an alarm state for **Whenever this alarm state is**.
For **select an SNS topic**, choose an existing SNS topic. If you select **Create topic**, you can set the name and email addresses for a new email subscription list. This list is saved and appears in the field for future alarms. Choose **Next**.
**Note**
If you use **Create topic** to create a new Amazon SNS topic, the email addresses must be verified before they receive notifications. Emails are only sent when the alarm enters an alarm state. If this alarm state change happens before the email addresses are verified, they do not receive a notification.
1. Fill in the **Name**, **Description**, and **Whenever** values for the metric, and choose **Next**.
1. On the **Preview and create** page, review the alarm you're about to create, and then choose **Create Alarm**.
**To set alarms using the CloudWatch console**
1. Sign in to the AWS Management Console and open the CloudWatch console at [https://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/).
1. Choose **Create Alarm** to start the **Create Alarm Wizard**.
1. Choose **FSx Metrics**, and scroll through the Amazon FSx metrics to locate the metric you want to place an alarm on. To display just the Amazon FSx metrics in this dialog box, search on the file system ID of your file system. Select the metric to create an alarm on, and choose **Next**.
1. Fill in the **Name**, **Description**, and **Whenever** values for the metric.
1. If you want CloudWatch to send you an email when the alarm state is reached, for **Whenever this alarm**, choose **State is ALARM**. For **Send notification to**, choose an existing SNS topic. If you select **Create topic**, you can set the name and email addresses for a new email subscription list. This list is saved and appears in the field for future alarms.
**Note**
If you use **Create topic** to create a new Amazon SNS topic, the email addresses must be verified before they receive notifications. Emails are only sent when the alarm enters an alarm state. If this alarm state change happens before the email addresses are verified, they do not receive a notification.
1. At this point, the **Alarm Preview** area gives you a chance to preview the alarm you're about to create. Choose **Create Alarm**.
**To set a CloudWatch alarm (CLI)**
+ Call `[put-metric-alarm](https://docs.aws.amazon.com/cli/latest/reference/put-metric-alarm.html)`. For more information, see *[AWS CLI Command Reference](https://docs.aws.amazon.com/cli/latest/reference/)*.
**To set an alarm (API)**
+ Call `[PutMetricAlarm](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutMetricAlarm.html)`. For more information, see *[Amazon CloudWatch API Reference](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/)*.
# Logging Amazon FSx for Windows File Server API calls using AWS CloudTrail
Amazon FSx for Windows File Server is integrated with AWS CloudTrail, a service that provides a record of actions taken by a user, role, or an AWS service in Amazon FSx. CloudTrail captures all API calls for Amazon FSx as events. The calls captured include calls from the Amazon FSx console and code calls to the Amazon FSx API operations. If you create a trail, you can enable continuous delivery of CloudTrail events to an Amazon S3 bucket, including events for Amazon FSx. If you don't configure a trail, you can still view the most recent events in the CloudTrail console in **Event history**. Using the information collected by CloudTrail, you can determine the request that was made to Amazon FSx, the IP address from which the request was made, who made the request, when it was made, and additional details.
To learn more about CloudTrail, see the [AWS CloudTrail User Guide](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html).
## Amazon FSx information in CloudTrail
CloudTrail is enabled on your AWS account when you create the account. When activity occurs in Amazon FSx, that activity is recorded in a CloudTrail event along with other AWS service events in **Event history**. You can view, search, and download recent events in your AWS account. For more information, see [Viewing events with CloudTrail Event history](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events.html).
For an ongoing record of events in your AWS account, including events for Amazon FSx, create a trail. A *trail* enables CloudTrail to deliver log files to an Amazon S3 bucket. By default, when you create a trail in the console, the trail applies to all AWS Regions. The trail logs events from all Regions in the AWS partition and delivers the log files to the Amazon S3 bucket that you specify. Additionally, you can configure other AWS services to further analyze and act upon the event data collected in CloudTrail logs. For more information, see the following:
+ [Overview for creating a trail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html)
+ [CloudTrail supported services and integrations](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-aws-service-specific-topics.html)
+ [Configuring Amazon SNS notifications for CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/configure-sns-notifications-for-cloudtrail.html)
+ [Receiving CloudTrail log files from multiple regions](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html) and [Receiving CloudTrail log files from multiple accounts](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-receive-logs-from-multiple-accounts.html)
All Amazon FSx actions are logged by CloudTrail and are documented in the [Amazon FSx API Reference](https://docs.aws.amazon.com/fsx/latest/APIReference/Welcome.html). For example, calls to the `CreateFileSystem`, `CreateBackup` and `TagResource` actions generate entries in the CloudTrail log files.
Every event or log entry contains information about who generated the request. The identity information helps you determine the following:
+ Whether the request was made with root or AWS Identity and Access Management (IAM) user credentials.
+ Whether the request was made with temporary security credentials for a role or federated user.
+ Whether the request was made by another AWS service.
For more information, see the [CloudTrail userIdentity element](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html).
## Understanding Amazon FSx log file entries
A trail is a configuration that enables delivery of events as log files to an Amazon S3 bucket that you specify. CloudTrail log files contain one or more log entries. An event represents a single request from any source and includes information about the requested action, the date and time of the action, request parameters, and so on. CloudTrail log files aren't an ordered stack trace of the public API calls, so they don't appear in any specific order.
The following example shows a CloudTrail log entry that demonstrates the `TagResource` operation when a tag for a file system is created from the console.
```
{
"eventVersion": "1.05",
"userIdentity": {
"type": “Root”,
"principalId": “111122223333”,
"arn": "arn:aws:sts::111122223333:root”,
"accountId": “111122223333”,
"accessKeyId": "AKIAIOSFODNN7EXAMPLE”,
"sessionContext": {
"attributes": {
"mfaAuthenticated": "false",
"creationDate": "2018-11-14T22:36:07Z"
}
}
},
"eventTime": "2018-11-14T22:36:07Z",
"eventSource": "fsx.amazonaws.com",
"eventName": "TagResource",
"awsRegion": "us-east-1",
"sourceIPAddress": “192.0.2.0”,
"userAgent": “console.amazonaws.com”,
"requestParameters": {
"resourceARN": "arn:aws:fsx:us-east-1:111122223333:file-system/fs-ab12cd34ef56gh789”
},
"responseElements": null,
"requestID": “aEXAMPLE-abcd-1234-56ef-b4cEXAMPLE51”,
"eventID": “bEXAMPLE-gl12-3f5h-3sh4-ab6EXAMPLE9p”,
"eventType": "AwsApiCall",
"apiVersion": "2018-03-01",
"recipientAccountId": “111122223333”
}
```
The following example shows a CloudTrail log entry that demonstrates the `UntagResource` action when a tag for a file system is deleted from the console.
```
{
"eventVersion": "1.05",
"userIdentity": {
"type": “Root”,
"principalId": "111122223333",
"arn": "arn:aws:sts::111122223333:root",
"accountId": "111122223333",
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"sessionContext": {
"attributes": {
"mfaAuthenticated": "false",
"creationDate": "2018-11-14T23:40:54Z"
}
}
},
"eventTime": "2018-11-14T23:40:54Z",
"eventSource": "fsx.amazonaws.com",
"eventName": "UntagResource",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "console.amazonaws.com",
"requestParameters": {
"resourceARN": "arn:aws:fsx:us-east-1:111122223333:file-system/fs-ab12cd34ef56gh789"
},
"responseElements": null,
"requestID": "aEXAMPLE-abcd-1234-56ef-b4cEXAMPLE51",
"eventID": "bEXAMPLE-gl12-3f5h-3sh4-ab6EXAMPLE9p",
"eventType": "AwsApiCall",
"apiVersion": "2018-03-01",
"recipientAccountId": "111122223333"
}
```